CISA Flags Two Hitachi Energy TRO600 Vulnerabilities Enabling Remote Code Execution

En bref

• Two CVEs affect Hitachi Energy TRO600 devices.
• An authenticated attacker can achieve remote code execution.
• Other issues include missing authentication and weak communication restrictions.
• CISA advises mitigation and remediation for global energy deployments.

Hitachi Energy has disclosed two security defects in its TRO600 series, with CISA publishing an advisory that tracks CVE-2026-10756 and CVE-2026-106087. The flaws matter because they can be triggered by someone who already has valid credentials, not only by an unauthenticated outsider.

According to the advisory, the consequences include arbitrary code execution, exposure of confidential data, a missing authentication check, and insufficient restriction of communications. Those weaknesses could let an authenticated actor move from a foothold into deeper control of affected devices or intercept information that should remain protected.

The products are used in energy environments and are deployed around the world, so the exposure is not confined to a single region. Utilities and other operators that rely on TRO600 hardware for operational technology should treat the advisory as a priority, especially where remote access and third-party connections are common.

Because the attacker must authenticate first, the risk is not a simple internet-wide worm. However, stolen or weak credentials, insider misuse, or a compromised account can turn these bugs into a serious path to code execution and data theft. In the energy sector, that combination can affect availability and trust in industrial control networks.

CISA's guidance points to both mitigation and remediation. Administrators should watch for vendor updates, review authentication and network segmentation, and monitor for unusual activity on TRO600 devices. The key question is how quickly affected organizations can inventory exposed units and close the gaps before an authenticated intruder exploits them.

À faire maintenant

1. Inventory all TRO600 series devices and identify internet-facing or remotely accessible units.
2. Apply Hitachi Energy remediation or mitigation guidance as soon as possible; track CVE-2026-10756 and CVE-2026-106087.
3. Enforce strong authentication and MFA where supported; rotate credentials for accounts with access to TRO600 devices.
4. Restrict network communication to only required endpoints and protocols; segment OT networks from IT and internet.
5. Monitor logs for anomalous authenticated activity, unexpected code execution, and data access.
6. Review third-party and remote access paths; disable unused accounts and services.
7. Prepare incident response and validate backups before patching.

Références CVE

• CVE-2026-10756
• CVE-2026-106087

Source originale

CISA Advisories